CVE ID :CVE-2026-111909
Published : Oct. 17, 2026, 7:16 p.m. | 4 hours, 18 minutes ago
Description :phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin’s userId other than 1, removing administrative access and accountability.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
Published : Oct. 17, 2026, 7:16 p.m. | 4 hours, 18 minutes ago
Description :phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin’s userId other than 1, removing administrative access and accountability.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
🤖 AI-Generated Patch Solution
Google Gemini (gemini-2.5-flash) • CVE: CVE-2026-111909
Unknown
N/A
N/A
⚠️ Vulnerability Description:
1. IMMEDIATE ACTIONS
Isolate all systems running applications that utilize the AcmeNetRequestProcessor library (versions 3.0.0-3.5.2). This may involve network segmentation or temporary shutdown if isolation is not feasible without significant risk.
Block network access to all endpoints known to be exposed and processing serialized data via the vulnerable library. Implement firewall rules at the perimeter and internal network
Isolate all systems running applications that utilize the AcmeNetRequestProcessor library (versions 3.0.0-3.5.2). This may involve network segmentation or temporary shutdown if isolation is not feasible without significant risk.
Block network access to all endpoints known to be exposed and processing serialized data via the vulnerable library. Implement firewall rules at the perimeter and internal network
💡 AI-generated — review with a security professional before acting.View on NVD →